General
-
Target
83fc2e19a4bf5e2c24bdbb7d959adb2dc30692359eb1f82737af6c5b155713b9
-
Size
396KB
-
Sample
230129-18fg3afa73
-
MD5
379fa442b74fd151d7a9d78fc02e214d
-
SHA1
59e650429b35e4d6b878675500b91f3562ddcfe9
-
SHA256
83fc2e19a4bf5e2c24bdbb7d959adb2dc30692359eb1f82737af6c5b155713b9
-
SHA512
1e4fad08acf73e48c9d1b2c68421553cc3b28adca7d219279ef73e18c6750de7306a32ebed9ddc6805179b2e00b0c78d7285fa6cc1747f15ce36379592100d8f
-
SSDEEP
3072:2t0LMynRuqwIuj6jwGOL350g8WZSLqyALq+vcuAFbF/vBgamzn46yaB3YnvQZa9z:A0LlI9EOLCgfgO6t3mzn4d8ieEWajF3
Static task
static1
Behavioral task
behavioral1
Sample
83fc2e19a4bf5e2c24bdbb7d959adb2dc30692359eb1f82737af6c5b155713b9.exe
Resource
win7-20221111-en
Malware Config
Extracted
redline
fredy
62.204.41.170:4132
-
auth_value
880249eef9593d49a1a3cddf57c5cb35
Targets
-
-
Target
83fc2e19a4bf5e2c24bdbb7d959adb2dc30692359eb1f82737af6c5b155713b9
-
Size
396KB
-
MD5
379fa442b74fd151d7a9d78fc02e214d
-
SHA1
59e650429b35e4d6b878675500b91f3562ddcfe9
-
SHA256
83fc2e19a4bf5e2c24bdbb7d959adb2dc30692359eb1f82737af6c5b155713b9
-
SHA512
1e4fad08acf73e48c9d1b2c68421553cc3b28adca7d219279ef73e18c6750de7306a32ebed9ddc6805179b2e00b0c78d7285fa6cc1747f15ce36379592100d8f
-
SSDEEP
3072:2t0LMynRuqwIuj6jwGOL350g8WZSLqyALq+vcuAFbF/vBgamzn46yaB3YnvQZa9z:A0LlI9EOLCgfgO6t3mzn4d8ieEWajF3
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-